Your Server Holds Everything.
Is the Backup Actually Off-Site?

Why your server is a single point of failure

A Windows Server in a small business tends to accumulate everything that matters. That is not a criticism of the setup, it is just how it works. Shared folders get mapped as network drives. QuickBooks company files get hosted there so multiple users can work in them simultaneously. A line-of-business application stores its database on the server. If the server also runs Active Directory, every user login and group policy in the building depends on it. Accounting records, document repositories, and years of business data live in one place, in one building, on one machine.

That concentration is genuinely efficient during normal operations. It becomes a liability the moment something goes wrong. A single ransomware infection that reaches the server can encrypt every mapped drive and shared folder in one pass. A fire or flood in the server room takes down everything simultaneously. An accidental deletion of the wrong directory from a shared folder removes files that every user in the company depended on. The data is not lost because the server is poorly designed, it is concentrated because that is how a file server works, and concentration amplifies the consequence of any failure.

CISA's 3-2-1 backup rule is the most widely cited framework for addressing this: keep at least three copies of your data on at least two different types of media, with at least one copy stored off-site. The FTC's small-business guidance echoes the same principle: no single-location copy is adequate, and off-site storage is a core requirement for recovery from physical disasters. For a small business, the server is typically the primary copy. That means two additional independent copies are needed, at least one of which is off-site and not reachable from the same network.

The rest of this page focuses on what Windows Server Backup does and does not provide, what a complete plan looks like, and a set of honest answers to the most common questions.

What Windows Server Backup does, and where it stops

Windows Server Backup is a real tool and it is worth describing accurately. It ships with Windows Server as an optional feature, it is free to install, and it is more capable than many people realize. It is also not enough on its own, for specific and grounded reasons.

Windows Server Backup can perform full server backups, system state backups that include Active Directory and the registry, bare-metal recovery images, and volume-level backups. It supports Volume Shadow Copy Service, which allows it to capture consistent snapshots of volumes including files that are currently open. It can be scheduled to run automatically on a daily or custom schedule. For a business that has never backed up its server at all, enabling Windows Server Backup is a meaningful improvement.

The gap is where the backup goes. By default, Windows Server Backup writes to a locally attached disk or to a network share. Both of those destinations are online and reachable from the server during normal operation. That matters for two reasons that CISA's #StopRansomware guidance makes explicit.

• Ransomware can reach an online backup destination. If ransomware executes on the server, it runs with access to every volume the operating system can reach, including the attached backup disk and any network share the server can write to. CISA specifically recommends at least one offline or air-gapped backup copy, meaning a copy that is not mounted and not reachable from a running system, precisely because online storage is vulnerable to the same ransomware that threatens the primary data.
• A local backup is still in the same building. A backup drive plugged into the server or a NAS on the same network does not satisfy the off-site requirement. A fire, a flood, or a theft that affects the server room affects the backup at the same time. CISA's 3-2-1 rule requires at least one copy at a physically separate location.
• Retention is limited by local storage capacity. Windows Server Backup manages retention based on available disk space. Once the backup volume fills, it overwrites older backups. For businesses that discover a ransomware infection or accidental deletion days or weeks after it occurred, a short retention window means the last clean backup may already be gone.

None of this makes Windows Server Backup a poor tool. For the job it was designed for, which is creating recoverable backups on hardware you control in your location, it works. The issue is that it does not, on its own, satisfy the off-site and air-gapped requirements that protect against the scenarios most likely to result in permanent data loss.

It is also worth noting that if your server runs RAID, the RAID array addresses availability through hardware failure, not backup. Ransomware encrypts the array along with everything else, accidental deletions propagate across the array immediately, and every disk in the array sits in the same building. RAID and Windows Server Backup together still leave you without an off-site copy. For a full explanation of why RAID does not substitute for backup, see the RAID is not a backup page.

What a complete server backup plan looks like

A complete plan for a small-business Windows Server layers multiple copies, locations, and protections in a way that addresses the real failure scenarios: hardware failure, ransomware, accidental deletion, and physical disaster. The following criteria are grounded in CISA's 3-2-1 rule, CISA's #StopRansomware guidance, and FTC small-business recommendations.

• Apply the 3-2-1 rule to the server. Three copies of your data, on at least two different types of media, with at least one copy stored off-site. Your server's primary storage is one copy. A local backup, whether through Windows Server Backup or another tool, is a second copy. An off-site cloud backup is the third copy and the one that protects against physical disasters and site-level events.
• Maintain at least one offline or air-gapped copy. CISA's #StopRansomware guidance calls explicitly for a backup that is not accessible from the running system during normal operation. An off-site cloud backup stored in an environment your server cannot write to directly satisfies this requirement in a way that a locally attached disk or a network share does not.
• Cover the whole server, not just a few folders. A server backup plan should cover shared file-server folders, QuickBooks company files, SQL and line-of-business application databases, Active Directory and domain controller state, accounting repositories, and any other data users depend on. Partial coverage means partial recovery.
• Retain 30 or more days of version history. Ransomware and accidental deletions are frequently discovered days or weeks after they occur. A backup solution that retains point-in-time versions over at least 30 days gives you the option to recover from before a problem happened, not just from the current state of the server.
• Schedule backups automatically and consistently. A backup that runs on a defined automatic schedule removes the dependency on someone remembering to initiate it. Manual backup habits erode under workload pressure. An automated schedule maintains coverage without requiring daily attention.
• Receive failure alerts without having to check manually. If a scheduled backup fails or if several days pass without a successful backup completing, someone should be notified automatically. A backup gap that goes unnoticed for weeks is not meaningfully different from having no backup.
• Test a restore on a regular basis. A backup that has never been successfully restored is an assumption, not a guarantee. Restore at least one folder or dataset from your backup at a regular interval to confirm the data is intact and that you understand the recovery steps before you need them under pressure. Annual testing is a minimum; quarterly is more reliable.

If you want to evaluate your current exposure to ransomware specifically, the ransomware restore readiness guide walks through the questions worth asking before an incident occurs. For a broader checklist covering backup requirements across an entire small business, including workstations as well as servers, see the small-business backup checklist. If your server files are also synced with OneDrive, Dropbox, or a similar tool, see the cloud sync vs. backup page for an explanation of why sync is not a substitute for backup.